I have successfully built the latest version 3.20.3.

### PKGBUILD for v3.20.3 ###

pkgname=nordvpn
pkgver=3.20.3
pkgrel=1
pkgdesc="NordVPN client for Linux"
arch=('x86_64' 'arm64')
url="https://github.com/NordSecurity/nordvpn-linux"
license=('GPL3')
makedepends=('go' 'mage' 'docker')
depends=('iptables' 'iproute2' 'wireguard-tools')
provides=('nordvpn')
conflicts=('openvpn-nordvpn' 'nordvpn-bin' 'nordvpn-cli-bin' 'nordvpn-git')
source=("https://github.com/NordSecurity/nordvpn-linux/archive/refs/tags/${pkgver}.tar.gz")
sha256sums=('32e86dec6807f61d7dd6120d57e17fcdf32f3966a879867ee25bfd48908bd9be')
install=nordvpn.install

prepare() {
    if ! $(groups | grep -q '\bdocker\b'); then
   	echo "You are not a member of the docker group. Docker is required to build the package."
        exit 1
    fi
    bsdtar -xf "${pkgver}.tar.gz"
    cd "nordvpn-linux-${pkgver}"
    patch --forward --strip=1 --input="${srcdir}/../ci_env.sh.patch"
    patch --forward --strip=1 --input="${srcdir}/../ci_compile.sh.patch"
    patch --forward --strip=1 --input="${srcdir}/../magefiles_scripts.go.patch"
}

build() {
    cd "nordvpn-linux-${pkgver}"
    cp .env.sample .env
    export pkgver=${pkgver}
    export ENVIRONMENT="prod"
    export VERSION=${pkgver}
    export CGO_CPPFLAGS="${CPPFLAGS}"
    export CGO_CFLAGS="${CFLAGS}"
    export CGO_CXXFLAGS="${CXXFLAGS}"
    export CGO_LDFLAGS="${LDFLAGS}"
    export GOFLAGS="-trimpath -ldflags=-linkmode=external -mod=readonly -modca

### ci_env.sh.patch ###

diff --git a/ci/env.sh b/ci/ci_env.sh
old mode 100755
new mode 100644
index aff4b72..4747c3e
--- a/nordvpn-linux-3.17.2/ci/env.sh
+++ b/home/atlee/Documents/ci_env.sh
@@ -4,36 +4,16 @@
 # dev and qa builds contain hash in version name
 set -euxo pipefail
 
-# if inside of docker container on CI || if inside of docker container on the host
-if grep docker /proc/self/cgroup || [ "$(< /proc/self/cgroup)" == "0::/" ]; then
-  # required for docker mounts to work correctly with mage targets
-  git config --global --add safe.directory "${WORKDIR}"
-fi
-
 NAME=nordvpn
 export NAME
 
 COVERDIR="covdatafiles"
 export COVERDIR
 
-HASH=$(git rev-parse --short HEAD)
+#HASH=$(git rev-parse --short HEAD)
+HASH=""
 export HASH
 
-OPENVPN_VERSION="2.5.8"
-export OPENVPN_VERSION
-OPENVPN_SHA256SUM="a6f315b7231d44527e65901ff646f87d7f07862c87f33531daa109fb48c53db2"
-export OPENVPN_SHA256SUM
-
-OPENSSL_VERSION="1.1.1t"
-export OPENSSL_VERSION
-OPENSSL_SHA256SUM="8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b"
-export OPENSSL_SHA256SUM
-
-LZO_VERSION="2.10"
-export LZO_VERSION
-LZO_SHA256SUM="c0f892943208266f9b6543b3ae308fab6284c5c90e627931446fb49b4221a072"
-export LZO_SHA256SUM
-
 VERSION_PATTERN="^[0-9]+\.[0-9]+\.[0-9]+$"
 if [[ "${CI_COMMIT_TAG:-}" =~ ${VERSION_PATTERN} ]]; then
   ENVIRONMENT="prod"
@@ -52,6 +32,6 @@ else
   export REVISION
 
   # '+' character is chosen because '_' is not allowed in .deb packages and '-' is not allowed in .rpm packages
-  VERSION="$(git tag -l --sort=-v:refname | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$" | head -1)+${REVISION}"
+#  VERSION="$(git tag -l --sort=-v:refname | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$" | sed -n 1p)+${REVISION}"
   export VERSION
 fi

### ci_compile.sh.patch ###

diff --git a/ci/env.sh b/ci/ci_env.sh
old mode 100755
new mode 100644
index aff4b72..4747c3e
--- a/nordvpn-linux-3.17.2/ci/env.sh
+++ b/home/atlee/Documents/ci_env.sh
@@ -4,36 +4,16 @@
 # dev and qa builds contain hash in version name
 set -euxo pipefail
 
-# if inside of docker container on CI || if inside of docker container on the host
-if grep docker /proc/self/cgroup || [ "$(< /proc/self/cgroup)" == "0::/" ]; then
-  # required for docker mounts to work correctly with mage targets
-  git config --global --add safe.directory "${WORKDIR}"
-fi
-
 NAME=nordvpn
 export NAME
 
 COVERDIR="covdatafiles"
 export COVERDIR
 
-HASH=$(git rev-parse --short HEAD)
+#HASH=$(git rev-parse --short HEAD)
+HASH=""
 export HASH
 
-OPENVPN_VERSION="2.5.8"
-export OPENVPN_VERSION
-OPENVPN_SHA256SUM="a6f315b7231d44527e65901ff646f87d7f07862c87f33531daa109fb48c53db2"
-export OPENVPN_SHA256SUM
-
-OPENSSL_VERSION="1.1.1t"
-export OPENSSL_VERSION
-OPENSSL_SHA256SUM="8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b"
-export OPENSSL_SHA256SUM
-
-LZO_VERSION="2.10"
-export LZO_VERSION
-LZO_SHA256SUM="c0f892943208266f9b6543b3ae308fab6284c5c90e627931446fb49b4221a072"
-export LZO_SHA256SUM
-
 VERSION_PATTERN="^[0-9]+\.[0-9]+\.[0-9]+$"
 if [[ "${CI_COMMIT_TAG:-}" =~ ${VERSION_PATTERN} ]]; then
   ENVIRONMENT="prod"
@@ -52,6 +32,6 @@ else
   export REVISION
 
   # '+' character is chosen because '_' is not allowed in .deb packages and '-' is not allowed in .rpm packages
-  VERSION="$(git tag -l --sort=-v:refname | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$" | head -1)+${REVISION}"
+#  VERSION="$(git tag -l --sort=-v:refname | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$" | sed -n 1p)+${REVISION}"
   export VERSION
 fi